> ## Documentation Index
> Fetch the complete documentation index at: https://docs.remyx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, scopes, key management, and response codes for the Remyx API.

The Remyx REST API is available at `https://engine.remyx.ai/api/v1.0`. Pass your scoped API key in the `Authorization` header as a Bearer token. Set `REMYXAI_API_KEY` in your shell before running the example.

```bash theme={null}
curl -H "Authorization: Bearer $REMYXAI_API_KEY" \
  https://engine.remyx.ai/api/v1.0/interests
```

> [!NOTE]
>
> Create a named API key under **Account > API keys** at [studio.remyx.ai/account?tab=keys](https://studio.remyx.ai/account?tab=keys). Each route is gated by [scopes](https://docs.remyx.ai/api-reference/scopes.md).

Keys come in two flavors, distinguished by prefix:

| Prefix | Type | Typical use | Expiry |
| - | - | - | - |
| `rmxu_…` | Personal | CLI, MCP, ad-hoc REST calls | None by default; optional 30, 90, or 365 days |
| `rmxa_…` | Automation | Minted by Outrider provisioning into repo secrets | 365 days |

Each key carries a set of **scopes** that gate which routes it can call (a route returning `403` means the key lacks the required scope). See [API Scopes](https://docs.remyx.ai/api-reference/scopes.md) for the full catalog, presets, and which surface needs what.

### Managing keys

Keys are created and managed under **Account > API keys** in the studio. The routes behind that page are **session-only**: they live under `/account/api-keys` (not `/api/v1.0`), require a browser login, and cannot be called with an API key.

```
GET    /account/api-keys                 # list keys, plus the scope catalog and presets
POST   /account/api-keys                 # {name, scopes?, expires_in_days?}; plaintext returned once
PATCH  /account/api-keys/<id>            # {name?, scopes?}; automation keys: rename only
POST   /account/api-keys/<id>/revoke     # stops working now; stays listed for audit
DELETE /account/api-keys/<id>
POST   /account/delete                   # delete the account: revokes every key, disconnects integrations
```

You can only create personal (`rmxu_`) keys; automation keys are minted by provisioning. Omitting `scopes` creates a full-access key; an empty list is an error. Revoking an agent (`rmxa_`) key **pauses the agent that uses it**. See [Account](https://docs.remyx.ai/platform/configure/account.md).

> [!WARNING]
>
> The legacy single-token endpoints under `/account/tokens/*` are removed and now return `410 Gone`. Migrate to named keys via `/account/api-keys`.

### Response Codes

| Code | Meaning |
| - | - |
| `200` | Success |
| `201` | Created |
| `202` | Accepted (async task started) |
| `400` | Bad request (invalid parameters) |
| `401` | Unauthorized (missing or invalid token) |
| `403` | Forbidden (key lacks the required scope, or `validate_gated`) |
| `404` | Not found |
| `409` | Conflict (duplicate resource, stale `key_id`, pool still building, Checkout not configured) |
| `410` | Gone (legacy `/account/tokens/*` endpoints; use `/account/api-keys`) |
| `503` | A dependency is not configured on this server (for example the GitHub App) |
| `500` | Server error |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.